forked from extern/shorewall_code
parent
ad6401da8c
commit
be2110b47e
@ -450,13 +450,13 @@ use constant { STANDARD => 0x1, #defined by Netfilter
|
||||
REDIRECT => 0x20, #'REDIRECT'
|
||||
ACTION => 0x40, #An action (may be built-in)
|
||||
MACRO => 0x80, #A Macro
|
||||
LOGRULE => 0x100, #'LOG','NFLOG'
|
||||
LOGRULE => 0x100, #'LOG','ULOG','NFLOG'
|
||||
NFQ => 0x200, #'NFQUEUE'
|
||||
CHAIN => 0x400, #Manual Chain
|
||||
SET => 0x800, #SET
|
||||
AUDIT => 0x1000, #A_ACCEPT, etc
|
||||
HELPER => 0x2000, #CT:helper
|
||||
NFLOG => 0x4000, #NFLOG
|
||||
NFLOG => 0x4000, #NFLOG or ULOG
|
||||
INLINE => 0x8000, #Inline action
|
||||
STATEMATCH => 0x10000, #action.Invalid, action.Related, etc.
|
||||
USERBUILTIN => 0x20000, #Builtin action from user's actions file.
|
||||
@ -656,6 +656,7 @@ our %builtin_target = ( ACCEPT => STANDARD + FILTER_TABLE + NAT_TABLE + MAN
|
||||
TPROXY => STANDARD + MANGLE_TABLE,
|
||||
TRACE => STANDARD + RAW_TABLE,
|
||||
TTL => STANDARD + MANGLE_TABLE,
|
||||
ULOG => STANDARD + FILTER_TABLE + NAT_TABLE + MANGLE_TABLE + RAW_TABLE,
|
||||
);
|
||||
|
||||
our %ipset_exists;
|
||||
@ -3222,6 +3223,7 @@ sub initialize_chain_table($) {
|
||||
'REDIRECT' => NATRULE + REDIRECT + OPTIONS,
|
||||
'REDIRECT-' => NATRULE + REDIRECT + NATONLY,
|
||||
'TARPIT' => STANDARD + TARPIT + OPTIONS,
|
||||
'ULOG' => STANDARD + LOGRULE + NFLOG + OPTIONS,
|
||||
'WHITELIST' => STANDARD,
|
||||
);
|
||||
|
||||
@ -3279,6 +3281,7 @@ sub initialize_chain_table($) {
|
||||
'NFLOG' => STANDARD + LOGRULE + NFLOG + OPTIONS,
|
||||
'NFQUEUE' => STANDARD + NFQ + OPTIONS,
|
||||
'NFQUEUE!' => STANDARD + NFQ,
|
||||
'ULOG' => STANDARD + LOGRULE + NFLOG,
|
||||
'ADD' => STANDARD + SET,
|
||||
'DEL' => STANDARD + SET,
|
||||
'WHITELIST' => STANDARD,
|
||||
@ -6753,7 +6756,9 @@ sub log_rule_limit( $$$$$$$$;$ ) {
|
||||
}
|
||||
|
||||
if ( $config{LOGFORMAT} =~ /^\s*$/ ) {
|
||||
if ( $level =~ /^NFLOG/ ) {
|
||||
if ( $level =~ '^ULOG' ) {
|
||||
$prefix = "-j $level ";
|
||||
} elsif ( $level =~ /^NFLOG/ ) {
|
||||
$prefix = "-j $level ";
|
||||
} else {
|
||||
my $flags = $globals{LOGPARMS};
|
||||
@ -6798,7 +6803,9 @@ sub log_rule_limit( $$$$$$$$;$ ) {
|
||||
warning_message "Log Prefix shortened to \"$prefix\"";
|
||||
}
|
||||
|
||||
if ( $level =~ /^NFLOG/ ) {
|
||||
if ( $level =~ '^ULOG' ) {
|
||||
$prefix = "-j $level --ulog-prefix \"$prefix\" ";
|
||||
} elsif ( $level =~ /^NFLOG/ ) {
|
||||
$prefix = "-j $level --nflog-prefix \"$prefix\" ";
|
||||
} elsif ( $level =~ '^LOGMARK' ) {
|
||||
$prefix = join( '', substr( $prefix, 0, 12 ) , ':' ) if length $prefix > 13;
|
||||
@ -6848,7 +6855,9 @@ sub log_irule_limit( $$$$$$$$@ ) {
|
||||
}
|
||||
|
||||
if ( $config{LOGFORMAT} =~ /^\s*$/ ) {
|
||||
if ( $level =~ /^NFLOG/ ) {
|
||||
if ( $level =~ '^ULOG' ) {
|
||||
$prefix = "$level";
|
||||
} elsif ( $level =~ /^NFLOG/ ) {
|
||||
$prefix = "$level";
|
||||
} else {
|
||||
my $flags = $globals{LOGPARMS};
|
||||
@ -6893,7 +6902,9 @@ sub log_irule_limit( $$$$$$$$@ ) {
|
||||
warning_message "Log Prefix shortened to \"$prefix\"";
|
||||
}
|
||||
|
||||
if ( $level =~ /^NFLOG/ ) {
|
||||
if ( $level =~ '^ULOG' ) {
|
||||
$prefix = "$level --ulog-prefix \"$prefix\"";
|
||||
} elsif ( $level =~ /^NFLOG/ ) {
|
||||
$prefix = "$level --nflog-prefix \"$prefix\"";
|
||||
} elsif ( $level =~ '^LOGMARK' ) {
|
||||
$prefix = join( '', substr( $prefix, 0, 12 ) , ':' ) if length $prefix > 13;
|
||||
|
@ -456,6 +456,7 @@ our %capdesc = ( NAT_ENABLED => 'NAT',
|
||||
TIME_MATCH => 'Time Match',
|
||||
GOTO_TARGET => 'Goto Support',
|
||||
LOG_TARGET => 'LOG Target',
|
||||
ULOG_TARGET => 'ULOG Target',
|
||||
NFLOG_TARGET => 'NFLOG Target',
|
||||
LOGMARK_TARGET => 'LOGMARK Target',
|
||||
IPMARK_TARGET => 'IPMARK Target',
|
||||
@ -1101,6 +1102,7 @@ sub initialize( $;$$$) {
|
||||
TIME_MATCH => undef,
|
||||
GOTO_TARGET => undef,
|
||||
LOG_TARGET => undef,
|
||||
ULOG_TARGET => undef,
|
||||
NFLOG_TARGET => undef,
|
||||
LOGMARK_TARGET => undef,
|
||||
IPMARK_TARGET => undef,
|
||||
@ -1279,6 +1281,7 @@ sub initialize( $;$$$) {
|
||||
$globals{PRODUCT} = 'shorewall';
|
||||
$config{IPTABLES} = undef;
|
||||
$config{ARPTABLES} = undef;
|
||||
$validlevels{ULOG} = 'ULOG';
|
||||
} else {
|
||||
$globals{SHAREDIR} = "$shorewallrc{SHAREDIR}/shorewall6";
|
||||
$globals{PRODUCT} = 'shorewall6';
|
||||
@ -4282,23 +4285,25 @@ sub validate_level( $;$ ) {
|
||||
require_capability( "${value}_TARGET", "Log level $level", 's' );
|
||||
}
|
||||
|
||||
if ( $value eq 'NFLOG' ) {
|
||||
if ( $value =~ /^(NFLOG|ULOG)$/ ) {
|
||||
my $olevel = $value;
|
||||
|
||||
if ( $qualifier =~ /^[(](.*)[)]$/ ) {
|
||||
my @options = split /,/, $1;
|
||||
my $index = 0;
|
||||
my $prefix = lc $olevel;
|
||||
my $index = $prefix eq 'ulog' ? 3 : 0;
|
||||
|
||||
level_error( $rawlevel , $option ) if @options > 3;
|
||||
|
||||
for ( @options ) {
|
||||
if ( supplied( $_ ) ) {
|
||||
level_error( $rawlevel , $option ) unless /^\d+/;
|
||||
$olevel .= " --nflog-$suffixes[$index] $_";
|
||||
$olevel .= " --${prefix}-$suffixes[$index] $_";
|
||||
}
|
||||
|
||||
$index++;
|
||||
}
|
||||
|
||||
} elsif ( $qualifier =~ /^ --/ ) {
|
||||
return $rawlevel;
|
||||
} else {
|
||||
@ -4949,6 +4954,10 @@ sub Log_Target() {
|
||||
qt1( "$iptables $iptablesw -A $sillyname -j LOG" );
|
||||
}
|
||||
|
||||
sub Ulog_Target() {
|
||||
qt1( "$iptables $iptablesw -A $sillyname -j ULOG" );
|
||||
}
|
||||
|
||||
sub NFLog_Target() {
|
||||
qt1( "$iptables $iptablesw -A $sillyname -j NFLOG" );
|
||||
}
|
||||
@ -5134,6 +5143,7 @@ our %detect_capability =
|
||||
LENGTH_MATCH => \&Length_Match,
|
||||
LOGMARK_TARGET => \&Logmark_Target,
|
||||
LOG_TARGET => \&Log_Target,
|
||||
ULOG_TARGET => \&Ulog_Target,
|
||||
NFLOG_TARGET => \&NFLog_Target,
|
||||
NFLOG_SIZE => \&NFLog_Size,
|
||||
MANGLE_ENABLED => \&Mangle_Enabled,
|
||||
@ -5298,6 +5308,7 @@ sub determine_capabilities() {
|
||||
$capabilities{TIME_MATCH} = detect_capability( 'TIME_MATCH' );
|
||||
$capabilities{GOTO_TARGET} = detect_capability( 'GOTO_TARGET' );
|
||||
$capabilities{LOG_TARGET} = detect_capability( 'LOG_TARGET' );
|
||||
$capabilities{ULOG_TARGET} = detect_capability( 'ULOG_TARGET' );
|
||||
$capabilities{NFLOG_TARGET} = detect_capability( 'NFLOG_TARGET' );
|
||||
$capabilities{LOGMARK_TARGET} = detect_capability( 'LOGMARK_TARGET' );
|
||||
$capabilities{FLOW_FILTER} = detect_capability( 'FLOW_FILTER' );
|
||||
@ -6861,7 +6872,9 @@ sub get_configuration( $$$ ) {
|
||||
}
|
||||
|
||||
if ( supplied( $val = $config{LOG_BACKEND} ) ) {
|
||||
if ( $val eq 'netlink' ) {
|
||||
if ( $family == F_IPV4 && $val eq 'ULOG' ) {
|
||||
$val = 'ipt_ULOG';
|
||||
} elsif ( $val eq 'netlink' ) {
|
||||
$val = 'nfnetlink_log';
|
||||
} elsif ( $val eq 'LOG' ) {
|
||||
$val = $family == F_IPV4 ? 'ipt_LOG' : 'ip6t_LOG';
|
||||
|
@ -94,7 +94,7 @@ sub process_conntrack_rule( $$$$$$$$$$ ) {
|
||||
|
||||
my $level = '';
|
||||
|
||||
if ( $action =~ /^NFLOG/ ) {
|
||||
if ( $action =~ /^(?:NFLOG|ULOG)/ ) {
|
||||
$action = join( ":" , 'LOG', $action );
|
||||
}
|
||||
|
||||
|
@ -1580,7 +1580,7 @@ sub merge_levels ($$) {
|
||||
my $tag = $supparts[2];
|
||||
|
||||
if ( @supparts == 3 ) {
|
||||
return "$subordinate:$tag" if $target =~ /^NFLOG\b/;
|
||||
return "$subordinate:$tag" if $target =~ /^(?:NFLOG|ULOG)\b/;
|
||||
return "$target:none!:$tag" if $level eq 'none!';
|
||||
return "$target:$level:$tag" if $level =~ /!$/;
|
||||
return $subordinate if $subparts >= 2;
|
||||
@ -1588,7 +1588,7 @@ sub merge_levels ($$) {
|
||||
}
|
||||
|
||||
if ( @supparts == 2 ) {
|
||||
return $subordinate if $target =~ /^NFLOG\b/;
|
||||
return $subordinate if $target =~ /^(?:NFLOG|ULOG)\b/;
|
||||
return "$target:none!" if $level eq 'none!';
|
||||
return "$target:$level" if ($level =~ /!$/) || ($subparts < 2);
|
||||
}
|
||||
|
@ -334,10 +334,9 @@
|
||||
<listitem>
|
||||
<para><option>ULOG</option></para>
|
||||
|
||||
<para>IPv4 only. Added in Shoreawll 4.6.0 and removed in
|
||||
Shorewall 5.2.2. Queues the packet to a backend logging daemon
|
||||
using the ULOG netfilter target with the specified
|
||||
<replaceable>ulog-parameters</replaceable>.</para>
|
||||
<para>IPv4 only. Added in Shoreawll 4.6.0. Queues the packet to
|
||||
a backend logging daemon using the ULOG netfilter target with
|
||||
the specified <replaceable>ulog-parameters</replaceable>.</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
|
@ -326,8 +326,8 @@ REJECT(icmp-proto-unreachable):notice:IPv6,tunneling loc net
|
||||
<term>ULOG (ipt_ULOG)</term>
|
||||
|
||||
<listitem>
|
||||
<para>ULOG logging as described ablve. Only available for IPv4 and
|
||||
removed in Shorewall 5.2.2.</para>
|
||||
<para>ULOG logging as described ablve. Only available for
|
||||
IPv4.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
@ -343,10 +343,10 @@ REJECT(icmp-proto-unreachable):notice:IPv6,tunneling loc net
|
||||
<para>The currently-available and currently-selected IPv4 and IPv6
|
||||
backends are shown in /proc/sys/net/netfilter/nf_log:</para>
|
||||
|
||||
<programlisting>$ cat /proc/net/netfilter/nf_log
|
||||
<programlisting>cat /proc/net/netfilter/nf_log
|
||||
0 NONE (nfnetlink_log)
|
||||
1 NONE (nfnetlink_log)
|
||||
2 nf_log_ipv4 (nf_log_ipv4,nfnetlink_log)
|
||||
2 ipt_ULOG (ipt_ULOG,ipt_LOG,nfnetlink_log)
|
||||
3 NONE (nfnetlink_log)
|
||||
4 NONE (nfnetlink_log)
|
||||
5 NONE (nfnetlink_log)
|
||||
@ -354,10 +354,9 @@ REJECT(icmp-proto-unreachable):notice:IPv6,tunneling loc net
|
||||
7 NONE (nfnetlink_log)
|
||||
8 NONE (nfnetlink_log)
|
||||
9 NONE (nfnetlink_log)
|
||||
10 nf_log_ipv6 (nf_log_ipv6,nfnetlink_log)
|
||||
10 ip6t_LOG (ip6t_LOG,nfnetlink_log)
|
||||
11 NONE (nfnetlink_log)
|
||||
12 NONE (nfnetlink_log)
|
||||
$</programlisting>
|
||||
12 NONE (nfnetlink_log)</programlisting>
|
||||
|
||||
<para>The magic numbers (0-12) are Linux address family numbers (AF_INET
|
||||
is 2 and AF_INET6 is 10).</para>
|
||||
|
@ -279,11 +279,6 @@
|
||||
separate log through use of ulogd (<ulink
|
||||
url="http://www.netfilter.org/projects/ulogd/index.html">http://www.netfilter.org/projects/ulogd/index.html</ulink>).</para>
|
||||
|
||||
<note>
|
||||
<para>Support for ULOG was removed in Shorewall 5.2.2 as Netfilter
|
||||
has dropped support for ULOG.</para>
|
||||
</note>
|
||||
|
||||
<para>For a description of logging, see <ulink
|
||||
url="/shorewall_logging.html">shorewall-logging(5)</ulink>.</para>
|
||||
|
||||
|
@ -905,10 +905,9 @@
|
||||
role="bold">ULOG</emphasis>[(<replaceable>ulog-parameters</replaceable>)]</term>
|
||||
|
||||
<listitem>
|
||||
<para>IPv4 only. Added in Shorewall 4.5.10 and removed in
|
||||
5.2.2. Queues matching packets to a back end logging daemon
|
||||
via a netlink socket then continues to the next rule. See
|
||||
<ulink
|
||||
<para>IPv4 only. Added in Shorewall 4.5.10. Queues matching
|
||||
packets to a back end logging daemon via a netlink socket then
|
||||
continues to the next rule. See <ulink
|
||||
url="shorewall-logging.html">shorewall-logging(5)</ulink>.</para>
|
||||
|
||||
<para>Similar to<emphasis role="bold">
|
||||
|
@ -221,10 +221,9 @@
|
||||
role="bold">ULOG</emphasis>[(<replaceable>ulog-parameters</replaceable>)]</term>
|
||||
|
||||
<listitem>
|
||||
<para>IPv4 only. Added in Shorewall 5.1.9 and removed in
|
||||
Shorewall 5.2.2. Queues matching packets to a back end logging
|
||||
daemon via a netlink socket then continues to the next rule.
|
||||
See <ulink
|
||||
<para>IPv4 only. Added in Shorewall 5.1.9. Queues matching
|
||||
packets to a back end logging daemon via a netlink socket then
|
||||
continues to the next rule. See <ulink
|
||||
url="shorewall-logging.html">shorewall-logging(5)</ulink>.</para>
|
||||
|
||||
<para>Similar to<emphasis role="bold">
|
||||
@ -289,7 +288,7 @@
|
||||
|
||||
<para>Beginning with Shorewall 5.1.12, SNAT may be performed in the
|
||||
nat table's INPUT chain by specifying $FW rather than one or more
|
||||
interfaces.</para>
|
||||
interfaces. </para>
|
||||
|
||||
<para>Each interface must match an entry in <ulink
|
||||
url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
|
||||
|
@ -91,11 +91,6 @@
|
||||
<programlisting>LOG_LEVEL="NFLOG(1,0,1)"</programlisting>
|
||||
</note>
|
||||
|
||||
<note>
|
||||
<para>Support for ULOG was removed in Shorewall 5.2.2 as Netfilter has
|
||||
removed support for ULOG logging.</para>
|
||||
</note>
|
||||
|
||||
<para>Beginning with Shorewall 5.0.0, the log level may be followed by a
|
||||
colon (":") and a <firstterm>log tag</firstterm>. The log tag normally
|
||||
follows the packet disposition in Shorewall-generated Netfilter log
|
||||
@ -1430,8 +1425,7 @@ net all DROP info</programlisting>then the chain name is 'net-all'
|
||||
<listitem>
|
||||
<para>IPv4 only.</para>
|
||||
|
||||
<para>Use ULOG logging to ulogd. Support for ULOG was removed
|
||||
in Shorewall 5.2.2.</para>
|
||||
<para>Use ULOG logging to ulogd.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
|
@ -749,8 +749,7 @@ bar:debug</programlisting>
|
||||
<listitem>
|
||||
<para>Either a syslog level or a ULOG or NFLOG target
|
||||
expression (e.g., "NFLOG(1,0,1)"). Specifies how you want the
|
||||
logging done. Support for ULOG was removed in Shorewall
|
||||
5.2.2.</para>
|
||||
logging done.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
|
@ -277,7 +277,7 @@
|
||||
shell variable simplifies future changes. Here's what I had at one
|
||||
time:</para>
|
||||
|
||||
<programlisting>gateway:/etc/shorewall# grep -v ^\# * | egrep '\$LOG|LOGFILE'
|
||||
<programlisting>gateway:/etc/shorewall# grep -v ^\# * | egrep '\$LOG|ULOG|LOGFILE'
|
||||
params:LOG=NFLOG
|
||||
policy:loc $FW REJECT $LOG
|
||||
policy:net all DROP $LOG 10/sec:40
|
||||
@ -302,8 +302,8 @@ gateway:/etc/shorewall# </programl
|
||||
<quote><command>logwatch</command></quote> and
|
||||
<quote><command>dump</command></quote> commands.</para>
|
||||
|
||||
<para>The NFLOG target is a successor to ULOG. NFLOG may be followed by
|
||||
a list of up to three numbers in parentheses.</para>
|
||||
<para>The NFLOG target is a successor to ULOG. Both ULOG and NFLOG may
|
||||
be followed by a list of up to three numbers in parentheses.</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
@ -384,8 +384,8 @@ sync=1</programlisting>
|
||||
<term>ULOG (ipt_ULOG)</term>
|
||||
|
||||
<listitem>
|
||||
<para>ULOG logging as described ablve. Only available for IPv4 and
|
||||
removed in Shorewall 5.2.2.</para>
|
||||
<para>ULOG logging as described ablve. Only available for
|
||||
IPv4.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
@ -401,10 +401,10 @@ sync=1</programlisting>
|
||||
<para>The currently-available and currently-selected IPv4 and IPv6
|
||||
backends are shown in /proc/sys/net/netfilter/nf_log:</para>
|
||||
|
||||
<programlisting>$ cat /proc/net/netfilter/nf_log
|
||||
<programlisting>cat /proc/net/netfilter/nf_log
|
||||
0 NONE (nfnetlink_log)
|
||||
1 NONE (nfnetlink_log)
|
||||
2 nf_log_ipv4 (nf_log_ipv4,nfnetlink_log)
|
||||
2 ipt_ULOG (ipt_ULOG,ipt_LOG,nfnetlink_log)
|
||||
3 NONE (nfnetlink_log)
|
||||
4 NONE (nfnetlink_log)
|
||||
5 NONE (nfnetlink_log)
|
||||
@ -412,10 +412,9 @@ sync=1</programlisting>
|
||||
7 NONE (nfnetlink_log)
|
||||
8 NONE (nfnetlink_log)
|
||||
9 NONE (nfnetlink_log)
|
||||
10 nf_log_ipv6 (nf_log_ipv6,nfnetlink_log)
|
||||
10 ip6t_LOG (ip6t_LOG,nfnetlink_log)
|
||||
11 NONE (nfnetlink_log)
|
||||
12 NONE (nfnetlink_log)
|
||||
$</programlisting>
|
||||
12 NONE (nfnetlink_log)</programlisting>
|
||||
|
||||
<para>The magic numbers (0-12) are Linux address family numbers (AF_INET
|
||||
is 2 and AF_INET6 is 10).</para>
|
||||
|
Loading…
Reference in New Issue
Block a user